Dealing with Information Rights 


An agreed set of principles between the Parliamentary and Health Service 
Ombudsman’s Office and the Information Commissioner’s Office. 


Background 


Every citizen has a right to request public information under the Freedom of Information 
Act 2000 (FOIA) or the Environmental Information Regulations 2004, and request access to 
their own personal data, by way of a subject access request, under the Data Protection 


Act 1998 (DPA). 


These are important rights. The right of access to public information in appropriate 
circumstances is key to making public bodies transparent and accountable. The subject 
access right is a practical expression of the fundamental right of an individual to respect 
for their private life. It is the Information Commissioner’s responsibility to promote and 


uphold these rights. 


These individual rights can, however, be constrained in so far as that is necessary to 
protect the rights and freedoms of others or on other important public interest grounds. 
FOIA and DPA therefore provide for the withholding of information where there is a 
properly applied legislative mechanism for doing so. 


The Parliamentary and Health Service Ombudsman’s Office (PHSO) welcomes the rights of 
access set out in the Freedom of Information Act, Data Protection Act and Environmental 
Information Regulations. At the same time, by the Ombudsman’s governing legislation, 
investigations must be conducted in private and there are restrictions imposed on the 
disclosure of information obtained during or for the purposes of an investigation. These 
restrictions were imposed to ensure that the Ombudsman is able to carry out her statutory 
function efficiently and effectively and act as a necessary counterbalance to the wide 
powers of the Ombudsman to obtain information. 


This set of general principles has been drawn up to reflect the relative jurisdictions of the 
PHSO and the Information Commissioner’s Office (ICO), and the interaction between the 
relevant legislation that comes into play when dealing with information rights’. These 
interactions can be complex and this paper is not a comprehensive set of technical 
instructions but instead gives some context and agreed approaches to handling information 


requests. 
The legislative context 


Section 7 of the Parliamentary Commissioner Act 1967 and section 11 of the Health Service 
Commissioners Act 1993 both provide that the Ombudsman’s investigations shall be 
conducted in private. Section 11 of the Parliamentary Commissioner Act 1967 and section 
15 of the Health Service Commissioners Act 1993 state that the information obtained in 
the course of or for the purposes of those investigations can only be disclosed in the very 
specific circumstances set out in those sections. 


' These principles were drawn up specifically to address the position of the PHSO. The ICO recognises that 
they will have general relevance to the position of other ombudsmen but how far this is the case will depend 
on the details of the particular legislative framework within which each ombudsman works. 


Members of the public can request information from public authorities under the Freedom 
of Information Act. Where there is a Freedom of Information request relating to an 
Ombudsman’s investigation then consideration has to be given to the operation of 

section 44 of this Act. Section 44 of the Freedom of Information Act provides that 
information is exempt information if any other enactment prohibits its disclosure. 


Requests for personal data, as opposed to public information, can be made under the Data 
Protection Act. The application of the Data Protection Act and its interaction with both 
section 11 of the Parliamentary Commissioner Act 1967 and section 15 of the Health 
Service Commissioners Act 1993 is different to that of the Freedom of Information Act. 
Section 27 of the Data Protection Act overrides the statutory bar in the Parliamentary 
Commissioner Act and the Health Service Commissioners Act. This means that personal 
data can only be withheld where a relevant Data Protection Act exemption applies. 


This does not mean, however, that all personal data has to be released under the 
provisions of the Data Protection Act as a matter of course. Section 31(4) of the Data 
Protection Act allows the Ombudsman to deny access to personal data to the extent that 
providing access to that personal data would be likely to prejudice the proper discharge of 
her statutory functions. 


The PHSO has explained that if information from a complaint file is released under the 
Data Protection Act (when PHSO’s legislation makes clear that the Ombudsman’s 
investigations are undertaken in private and information should only be disclosed in very 
limited circumstances) the bodies investigated are likely to be less inclined to give all the 
information the Ombudsman needs in order to carry out her statutory function effectively. 


Parliament accepted that there was a clear public interest behind the statutory bar - 
which led directly to the passing of section 31(4) of the Data Protection Act, and the 
existence of the statutory bar is a relevant factor in determining whether personal 
information should be released. In effect, section 31(4) helps the Ombudsman to carry out 
her functions in a manner that encourages people to provide her with the information she 
needs in order to investigate the complaints put to her. 


However, the existence of the ‘likely to prejudice’ test makes clear that this exemption 
does not operate as a blanket application covering all personal data in all complaints 
investigations, and the exemption applies ‘only to the extent which’ release of personal 
information would be likely to cause prejudice. 


PHSO must, therefore, balance its duty to operate openly and transparently with its duty 
to act within the legislation that governs its work and to protect the privacy of personat 
and other information given to the Ombudsman in confidence. 


How PHSO will handle information requests 


PHSO will process information requests in line with the requirements of the Freedom of 
Information Act, Environmental Information Regulations, and Data Protection Act while at 
the same time protecting information which should remain private in line with the 
legislation that governs the Ombudsman’s work. In order to achieve this balance, PHSO 
will take a three-step approach and consider all of the legislative requirements when 
handling information requests. Those three steps are: 


e Disclosure by PHSO under the Parliamentary Commissioner Act 1967 and the 
Health Service Commissioners Act 1993. 


e Disclosure by PHSO under the Freedom of Information Act 2000 (or Environmental 
Information Regulations 2004). 
e Disclosure by PHSO under the Data Protection Act 1998. 


The Annexes to these principles set out both how PHSO will handle information requests in 
line with the relevant legislation and what the ICO will take into account when considering 
a complainant's rights and the application of the Freedom of Information Act (or 
Environmental Information Regulations) and the Data Protection Act. 
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Annex A 


Disclosure by PHSO under the Parliamentary Commissioner Act 1967 and the Health 
Service Commissioners Act 1993 


The Ombudsman will consider whether the information requested can be released under 
its own legislation (the Parliamentary and Health Service Commissioners Acts) taking into 
account the following provisions: 


e Section 7 of the Parliamentary Commissioner Act 1967 and section 11 of the 
Health Service Commissioners Act 1993, which both provide that the 
Ombudsman's investigations shall be conducted in private. 


e Section 11 of the Parliamentary Commissioner Act and section 15 of the Health 
Service Commissioners Act, which prevent information obtained by the 
Ombudsman or her officers in the course of or for the purposes of an investigation 
from disclosure, except in very limited circumstances.* (The most relevant of 
those circumstances is for the purposes of an investigation and for any report to 
be made in respect of an investigation. ) 


Under the provisions of the legislation that governs the Ombudsman’s work, therefore, the 
information that can be disclosed about her investigations is limited. In practice, this 
means that information obtained in the course of or for the purposes of an investigation 
wilt be released when doing so is for the purposes of that investigation (for example, to 
make enquiries of the body complained about) or for the investigation report/decision 
letter. This ensures that a complainant sees the information (both personal and non- 
personal) which is material to the decision to enable the complainant to make 
representations about findings and recommendations (if any). 


This information may well go beyond the information that a requester would be entitled to 
under the Freedom of Information Act, Data Protection Act and Environmental Information 
Regulations, and may include, for example, information subject to legal privilege. Any 
information which has been obtained but which is not material to the investigation or 
report/decision letter will not be disclosed. 


? This includes in the course of or for the purposes of deciding whether or not to investigate a complaint. 


Annex B 


Disclosure by PHSO under the Freedom of Information Act 2000 (or Environmental 
Information Regulations 2004) 


PHSO will also consider whether the information requested can be released under the 
Freedom of Information Act 2000 (or Environmental Information Regulations). 


Section 44(1)(a} of the Freedom of Information Act exempts information from release if its 
disclosure is prohibited under any other enactment. Therefore, any information obtained 
by the Ombudsman for the purposes of or during the course of an investigation, and which 
falls, therefore, within the statutory bar at section 11 of the Parliamentary Commissioner 
Act and section 15 of the Health Service Commissioners Act, is exempt from disclosure 
under the Freedom of Information Act. This exemption is absolute, that is, it cannot be 
overridden whatever the public interest is in releasing the material concerned. 


In terms of considering an information request under the Environmental Information 
Regulations, PHSO will consider each case carefully taking into account any relevant 
exceptions (most notably section 12(4}(e) and section 12(5)(d)). 


information Commissioner’s considerations under the Freedom of Information Act 2000 
(or Environmental Information Regulations 2004) 


If the complainant exercises their rights to approach the Information Commissioner then 
the Information Commissioner will consider the complaint. Where information has not 
been released under the Freedom of Information Act an appropriate refusal notice will 
have been issued and PHSO wilt be prepared to explain its position to the ICO with that in 
mind. 


The Information Commissioner will consider the refusal reasons and take into account the 
application of section 44 where appropriate. 


Information obtained by the Ombudsman for the purposes of or during the course of an 
investigation is caught by the statutory bar and cannot be disclosed for purposes other 
than that set out in the legislation. 


Information held by a public authority which emanates from the Ombudsman (that is, 
information that has been obtained by the Ombudsman for the purposes of or during the 
course of an investigation) is again caught by the statutory bar and cannot be disclosed. 


Information created by a public authority for the purposes of an investigation by the 
Ombudsman is also caught by the statutory bar. 


Information which is held by a public authority for the purposes of its own function and is 
not caught by the provisions above, but which has been shared with the Ombudsman 
during the course of or for the purposes of an investigation does not fall within the 
statutory bar and should therefore be disclosed or withheld by that public authority under 
a different provision in the Freedom of Information Act. 


Annex C 


Disclosure by PHSO under the Data Protection Act 1998 


PHSO wilt also consider individual rights under the Data Protection Act taking into account 
any relevant exemption. 


It is noted that any information on a complaint file could be personal information, but not 
all information on a case file will necessarily fall into this category. 


As set out above, the need to protect the privacy of the investigation and ensure the 
efficient and effective exercise of her statutory functions, means that the Ombudsman will 
take decisions on disclosure under the Data Protection Act in light of the existence of and 
intention behind sections 7 and 11 of the Parliamentary Commissioner Act 1967, sections 
11 and 15 of the Health Service Commissioners Act, and section 7, section 27(5) and 
section 31(4) of the Data Protection Act. 


This does not mean that PHSO does or will adopt a blanket approach to considering 
individual requests for information under the Data Protection Act or to applying 

section 31(4) of the Data Protection Act. Instead PHSO will consider carefully each 
individual case in order to ascertain whether there is a particular reason, in that case, for 
overriding the individual’s nght of access by maintaining the statutory bar and withholding 
personal information (not already disclosed for the purposes of the investigation). 


If PHSO concludes that section 31(4) of the Data Protection Act is applicable, PHSO will 
need to be specific in identifying/describing the classes/categories of documents that are, 
in its view, exempt from disclosure and then explain why section 31(4) is applicable to 
those classes of documents. Careful consideration to identify personal data will need to be 
carried out to satisfy the requirements of the access provisions under both the Data 
Protection Act and PHSO’s governing legislation, but PHSO does not need to adopt a 
document by document or line by line explanation to the ICO. 


Information Commissioner’s considerations under the Data Protection Act 1998 


Where an individual approaches the ICO following a subject access request, under 
section 42 of the Data Protection Act, the ICO will be considering the application of the 
Act and adherence to the data protection principles. 


It is therefore important to make sure that enough information is provided with regard to 
the application of section 31 when withholding personal data. It should be remembered 
that the ICO, when carrying out an assessment, is considering if the principles of the Act 
are being applied and whether ultimately a breach of the Act is likely or unlikely. This may 
stop short of actually defining which pieces of personal data (if any) should be released 
but any explanation, both to the complainant and to the ICO will need to be sufficiently 
detailed to allow the assessment to be carried out from an informed point of view. As the 
application of section 31(4) of the Data Protection Act effectively curtails what would 
otherwise be the nights of individuals under the Data Protection Act, the ICO needs to be 
satisfied that where this exemption is relied upon, it is supported by reasonable argument 
rather than by the application of a blanket approach so that all parties are aware of the 
likely prejudice to statutory functions. 


